如何管理服务配置

// 硬编码方式 —— 不推荐
@HystrixCommand(fallbackMethod = "getDefaultProductInventoryByCode",
    commandProperties = {
       @HystrixProperty(name = "execution.isolation.thread.timeoutInMilliseconds", value = "3000"),
       @HystrixProperty(name = "circuitBreaker.errorThresholdPercentage", value="60")
    }
)
public Optional<ProductInventoryResponse> getProductInventoryByCode(String productCode) {
    // ...
}

// 代码中仅引用配置 Key
@HystrixCommand(commandKey = "inventory-by-productcode",
    fallbackMethod = "getDefaultProductInventoryByCode")
public Optional<ProductInventoryResponse> getProductInventoryByCode(String productCode) {
    // ...
}

# application.properties
hystrix.command.inventory-by-productcode.execution.isolation.thread.timeoutInMilliseconds=2000
hystrix.command.inventory-by-productcode.circuitBreaker.errorThresholdPercentage=60

# application.yml —— Spring Boot 2.4+
spring:
  config:
    import:
      - optional:file:./override.properties
      - optional:nacos:common.properties?group=DEFAULT_GROUP

# Nacos 3.x —— Spring Cloud Alibaba 配置示例
spring:
  cloud:
    nacos:
      config:
        server-addr: nacos-cluster:8848
        namespace: ${NAMESPACE:dev}
        group: ${GROUP:DEFAULT_GROUP}
        file-extension: yaml
        refresh-enabled: true          # 自动刷新
        shared-configs:                # 共享配置
          - data-id: common-db.yaml
            group: SHARED_GROUP
            refresh: true
        extension-configs:             # 扩展配置
          - data-id: redis-cluster.yaml
            group: INFRA_GROUP
            refresh: true

# Apollo 2.x —— 客户端配置（app.properties）
app.id=order-service
apollo.meta=http://apollo-config-service:8080
apollo.cluster=default
apollo.bootstrap.enabled=true
apollo.bootstrap.namespaces=application,FX-Common-Config
apollo.autoUpdateInjectedSpringProperties=true

// Apollo 2.x —— 动态配置使用示例
@ApolloConfigChangeListener
public void onChange(ConfigChangeEvent changeEvent) {
    for (String key : changeEvent.changedKeys()) {
        ConfigChange change = changeEvent.getChange(key);
        log.info("配置变更 - key: {}, old: {}, new: {}",
            key, change.getOldValue(), change.getNewValue());
    }
    // 根据变更刷新运行时状态
    refreshRateLimiter();
}

# ConfigMap —— 非敏感配置（Kubernetes 1.30+）
apiVersion: v1
kind: ConfigMap
metadata:
  name: order-service-config
  namespace: production
immutable: true                     # 1.21+ 特性，防止意外修改
data:
  APPLICATION_YML: |
    server:
      port: 8080
    spring:
      datasource:
        url: jdbc:mysql://mysql-primary:3306/order_db
      redis:
        cluster:
          nodes: redis-cluster:6379
  LOG_LEVEL: "INFO"
  RATE_LIMIT: "1000"

# Secret —— 敏感配置
apiVersion: v1
kind: Secret
metadata:
  name: order-service-secret
  namespace: production
type: Opaque
data:
  DB_PASSWORD: <base64-encoded>      # Base64 编码（非加密！）
  API_KEY: <base64-encoded>

# ArgoCD Application —— 声明式配置管理
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: order-service-configs
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/service-configs.git
    targetRevision: main
    path: overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true              # 自动检测并修复配置漂移
    syncOptions:
      - CreateNamespace=true

# SealedSecret —— 可安全存入 Git（v0.37+）
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: order-service-secret
  namespace: production
spec:
  encryptedData:
    DB_PASSWORD: AgBfj8eR2...（公钥加密后的密文）
    API_KEY: AgCK9xL3m...
  template:
    metadata:
      name: order-service-secret
      namespace: production
    type: Opaque

# 使用 kubeseal 加密
echo -n 'my-db-password' | kubectl create secret generic order-secret \
  --dry-run=client --from-file=db-password=/dev/stdin -o yaml | \
  kubeseal --format yaml > sealed-secret.yaml

# ESO —— 从 Vault 同步 Secret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: order-service-secret
  namespace: production
spec:
  refreshInterval: 1h              # 定期轮转
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: order-service-secret
    creationPolicy: Owner
  data:
    - secretKey: DB_PASSWORD
      remoteRef:
        key: secret/data/production/order-service
        property: db_password

# Vault —— 动态数据库凭证（v2.0+）
path "database/creds/order-service-role" {
  capabilities = ["read"]
}
 
# 动态凭证：每次读取生成临时账号，TTL 自动过期

# Vault Agent Sidecar 注入
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "order-service"
        vault.hashicorp.com/agent-inject-secret-db-creds: "database/creds/order-service-role"

// Spring Cloud —— @RefreshScope 方式（需引入 spring-cloud-starter）
@RefreshScope
@RestController
public class RateLimitController {
 
    @Value("${rate.limit:1000}")
    private int rateLimit;
 
    @GetMapping("/check")
    public boolean check() {
        return rateLimiter.tryAcquire(rateLimit);
    }
}
 
// Spring Cloud —— @ConfigurationProperties 方式（推荐）
@ConfigurationProperties(prefix = "rate.limit")
@Data
public class RateLimitProperties {
    private int maxRequests = 1000;
    private int windowSeconds = 60;
}

# 手动触发刷新（Spring Cloud Bus + 消息中间件可广播）
curl -X POST http://order-service:8080/actuator/refresh

// Spring Cloud Kubernetes —— 自动监听 ConfigMap 变更
// 依赖：spring-cloud-kubernetes-fabric8-config
@RefreshScope
@ConfigurationProperties(prefix = "app")
public class AppConfig {
    private String featureXEnabled;
    private int rateLimit;
    // ConfigMap 变更后自动刷新
}